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ABSTRACT 


Configuration management of managed objects is performed 
based upon performance data. Configuration management is 
performed on varying levels according to the amount of 
interpretation of the performance data that is required. Anew 
configuration for an object is determined based upon the 
performance data, and the object is reconfigured according 
to the new configuration. Analysis may be performed at 
varying levels by a reactive analyzer and a deliberative 
analyzer. 
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METHOD AND APPARATUS FOR REACTIVE 
AND DELIBERATIVE CONFIGURATION 
MANAGEMENT 

CROSS-REFERENCE TO RELATED s 
APPLICATIONS 

This is a continuation-in-part of application Sen No. 
08/855,222, by U. Datta and L Lewis, entitled APPARA- 
TUS AND METHOD FOR NETWORK CAPACITY 
EVALUATION AND PLANNING, filed May 13, 1997 now 10 
U.S. Pat. No. 6,209,033. This is also a continuation of 
application Ser. No. 08/622,866, filed Mar. 29, 1996, now 
U.S. Pat. No. 5,889,953, which is a continuation application 
Ser. No. 08/450,854, filed May 25, 1995, now U.S. Pat. No. 
5,872,928. 15 

FIELD OF THE INVENTION 

The present invention is directed to configuration man- 
agement of communication networks, and more specifically 20 
to a method and apparatus for configuring managed objects 
in a reactive or deliberative manner. 

BACKGROUND OF THE INVENTION 

Configuration management is a process for identifying 25 
and controlling managed objects. In a communications 
network, these managed objects may represent concrete 
objects such as source/destination devices (end stations) that 
are attached to the network and intervening network devices 
such as servers, applications, routers, switches, hubs, 30 
bridges, etc. Devices may also be accessed through serial 
lines or similar devices or other method of communication. 
Managed objects may also represent abstract objects such as 
computer processes, software applications, business 
processes, and services. As used herein, objects include both 35 
concrete and abstract managed objects. 

Configuration management functions include: maintain- 
ing an inventory of network objects; knowing the configu- 
ration of each object; resetting or updating configurations as 
the need arises; scheduling configuration changes; adding 40 
and deleting users and resources on the network; and chang- 
ing resource operating parameters. For example, configura- 
tion management generally allows a network administrator 
to: 

make changes in a configuration of a device to improve 
performance of the object; 

initially configure network services provided by or asso- 
ciated with an object; 

make changes in network services provided by or asso- so 
ciated with an object; 

identify, browse, or store a configuration of an object. 

A "configuration" is a set of attributes that govern the 
operational characteristics of a object. The configuration 
may include, for example, port thresholds, operating state of 55 
a switch, access information, and the like. Objects that are 
configured routinely in communications networks include 
network devices such as routers, switches, bridges, and 
hubs. Configuration information is typically entered/ 
changed/deleted manually (i.e., through a dumb terminal), or 60 
manually/automatically by a network management system 
executing what is referred to as a configuration management 
program. 

For example, when managing a device manually using a 
dumb terminal, the terminal is physically attached to the 65 
network device and the network administrator issues com- 
mands through the terminars keyboard. Alternatively, the 
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network device is accessed remotely using an application 
that establishes a terminal connection to the device through 
a communications network. For example, an administrator 
may use the Telnet application at a remote station to estab- 
lish a Telnet terminal session to the device. The administra- 
tor issues commands which are transferred to the device 
through the network via the application (using the TCP/IP 
protocol) and then executed on the device. 

Another manual method utilizes a configuration manage- 
ment program residing on a general purpose computer, and 
executed by a network administrator. The administrator 
must manually provide the program with the configurations 
of the networking devices, or otherwise interpret perfor- 
mance data to determine new configurations. Examples of 
configuration management programs include SITE MAN- 
AGER available from Bay Networks Inc., Santa Clara, 
Calif., USA, and CISCOWORKS available from Cisco 
Systems Inc., Menlo Park, Calif., USA. 

In general, manual methods require significant user 
(administrator) interaction. In large networks having many 
devices, manual configuration of these devices is tedious 
and time-consuming for the administrator, and is susceptible 
to human error. Because of a continuing need for alleviating 
burdens on the network administrator, automatic methods of 
network management that require less user interaction have 
been developed. 

Automatic configuration management programs generally 
allow a network administrator to automate portions of 
certain labor-intensive tasks, e.g., loading new configura- 
tions in a number of routers, upgrading router software, or 
gathering configuration data. However, such automatic con- 
figuration programs are still not capable of loading configu- 
rations without user intervention or programming. Thus, a 
significant amount of user intervention is still required to 
operate such programs. 

Another disadvantage of known methods is that changes 
are determined by a network administrator having limited 
information about the network, and without support of 
exacting numeric methods or expert knowledge. Also, some 
configuration changes are not optimum for all periods of 
time, e.g., a special configuration is required because of 
network performance degradation during a specific time 
period, but is not optimum for other time periods. 
Furthermore, manual configuration changes may not be 
executed consistently throughout the network. 

Still further, some configuration changes need to be made 
quickly while others should be made based on data gathered 
over a long period of time. The process of collecting 
configurations, analyzing the information, and formulating 
new configuration information in response to the analysis is 
a lengthy, time-consuming process. Thus, manual methods 
do not allow a network manager to react with sufficient 
speed to implement configurations in an adequate manner. A 
method which automates such analysis and configuration 
tasks would be advantageous. 

There is therefore need for a system and method for 
automatic configuration management of networking devices 
that optimizes configurations for a designated time period 
and/or reduces the amount of user intervention and analysis 
required. 

SUMMARY OF THE INVENTION 

In accordance with one aspect of the present invention, a 
system and method are provided for the automatic configu- 
ration management of network devices, in which an analyzer 
processes a current configuration of a network device and 
network performance data and provides an updated configu- 
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ration to the network device to enhance performance of the improved performance (subsequent to the device being 

device. The system and method may determine the updated reconfigured) based upon an evaluation of a network per- 

configuration based on network management data indicative formance characteristic such as network capacity. 

of network performance. Configuration management may be These and other features and benefits of this invention are 

performed on varying levels according to the amount of 5 further described in the following detailed description and 

interpretation (processing) of the performance data that is drawings. 

required, the time available to perform a configuration task 

(urgency), or the amount of time required to collect the BRIEF DESCRIPTION OF THE DRAWINGS 
performance data. Analysis of the performance data may be 

performed at varying levels by a reactive analyzer and a 10 FIG. 1A is a block diagram of a known (prior art) network 

deliberative analyzer. A reactive analyzer may be, for management system which may be used in implementing an 

example, a rule-based event handler, a case-based reasoning embodiment of the present invention; 

structure, a neural network analyzer, threshold function, or FIG. IB shows a known (prior art) template listing and 

model-based reasoning structure. A deliberative analyzer configuration listing associated with a configuration record; 

may be, for example, a capacity planner or network admin- is FIG. 1C shows a known (prior art) graphical interface of 

istrator. a configuration management system; 

In one embodiment, a configuration management system FIG. ID shows another known (prior art) graphical inter- 
comprises a performance monitor, an event handler, a capac- face of a configuration management system; 
ity planner, and a configuration manager. The performance FIG. 2 is a functional block diagram of a configuration 
monitor monitors the network and provides as an output ™ mana g eme nt system for implementing one embodiment of 
performance data of the network. The event handler receives tne invention- 

the network performance data as an input and evaluates the - . ' L1 . - . 

performance data based upon a rule set; the event handler . ™*. 3 18 a blo ' k du « ram 0 a P ortlon f a ne ! wo *> 

also provides, as an output, an evaluation of the performance mclu ^ a net ™ rk "T? T ^ * g ™ P 

i . rpi i i »l * i n< menting an embodiment of the invention; 

data. The capacity planner also receives the network per- 25 5 ' 

formance data from the monitor and provides as an output an FIG *, 4 * a blo «; k diagram for implementing another 

evaluation of the capacity of the communications network. embodiment of the invention; 

The configuration manager receives as a first input the FIGS. 5A-5C show an exemplary network to be man- 
output of the event handler, and as a second input the output aged; and 

of the capacity planner. The output of the configuration 30 FIG. 6 is a flow chart of a configuration management 

manager is a command to the network device based on the process according to the invention, 
performance evaluation and the capacity evaluation. 

According to a method/embodiment for configuring a DETAILED DESCRIPTION 

network device in a communications network, the method ln accordance with one embodiment of the present 

includes the steps of: a) collecting performance data from invention, configuration management includes identifying, 

the communications network; b) evaluating the performance controlling, and monitoring managed objects in a commu- 

data according to a set of rules to generate a rule evaluation; n ications network. A managed object is any object that is 

c) determining a capacity evaluation of the network; d) modeled in a network mana gement system (NMS), such as 

determining a configuration for the network device based the SPECT RUM NMS available from Cabletron Systems, 

upon the rule evaluation and the capacity evaluation; and e) Inc<> Rochester, N.H., USA. The managed objects include 

configuring the device based on the determined configura- not only hardware devices such as personal cornputer s 

tlon * (PCS), workstations, hubs and routers, but also other entities 

Another aspect is directed to an apparatus for configuring such as software applications, business processes, computer 

a network device in a communications network, the appa- 45 processes, and services. 

ratus comprising means for collecting performance data A known configuration management system is provided 

from the communications network, means for evaluating the as a part of tne SPECTRUM network management system 

performance data according to a set of rules to generate a available &ora Cabletron Systems, Inc. and is described in 

rule evaluation, means for determining a capacity evaluation U-S . PaL Na 5,832,503, issued Nov. 3, 1998 to R. Malik et 

of the network, means for determining a new configuration 5Q aL> which fc hereby incorporated by reference in its entirety, 

for the network device based upon the rule evaluation and SPECTRUM network management system is also 

the capacity evaluation, and means for reconfiguring the Ascribed in U.S. Pat. No. 5,261,044, issued Nov. 9, 1993 to 

device based on the new configuration. R Dev et al . v s Pat No 5)4 3 6 ,909, issued Aug. 25, 1995 

Reconfiguration of a network device may include issuing to R. Dev et al.; and U.S. Pat. No.. 5,504,921 issued Apr. 2, 

commands for a new configuration of the device based upon 5S 1996 to R. Dev et al.; which are hereby incorporated by 

a capacity evaluation. The rule evaluation may be synthe- reference in their entirety. A method for managing business 

sized with the capacity evaluation to provide a single processes is described in U.S. Ser. No. 09/058,054 filed Apr. 

synthesized network evaluation. In at least one embodiment, 9, 1998 by L. Lewis et al., which is incorporated by 

the synthesis includes resolving one or more conflicts reference in its entirety. 

between a configuration determined by the rule evaluation 60 M shown in FIG 1Aj a ^ network management 

and a configuration determined by the capacity evaluation. (nm) station 101, for example running a copy of the 

In any of the above embodiments, the success of a SPECTRUM NMS, continually monitors network 103 and 

reconfiguration command to a network device may be maintains a database of information about managed objects 

verified by determining whether performance of the com- in the network. The NM station 101 obtains the values of 

munications network has improved subsequent to the com- 65 certain attributes, i.e. data which define characteristics of an 

mand being provided to the network device. Such an opera- NM agent 104 included within an object 115. For example, 

tion may include determining whether the network has object 115 may be a device attached to the distributed 
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network 103. The NM agent 104 is generally a process erally retrieves values by executing NM commands through 

executed in a managed object 115 that interacts with the NM NM process 105. The template functions as a filter, blocking 

station 101. Managed object 115 may include one or more out unwanted attributes and capturing values of those 

NM agents 104. There are typically a plurality of such attributes found in the template. 

managed objects 115, each having an NM agent 104. The S The resulting configuration created with the template 

NM station 101 may obtain information from agent 104 contains the attributes from the template and the values 

using a well-known network management protocol, such as collected from the model. The configuration may be stored 

SNMP; it should be understood that other network manage- in the CM subsystem 106, anywhere on the NM station 101, 

ment protocols may be used or otDer location. The configuration may be stored in a 

Within NM system 102, a configuration management 10 ^nfiguraUon file or record which is entered in a database or 


(CM) subsystem 106 maintains configuration data obtained 


i mi t tu r^KM u * ui FIG. IB illustrates a template and a configuration. Item 

from NM agent 104 The CM subsystem 106 enables a 13Q . for << n V_config_template>' which 

system administrator T20, via an admmistrator interface 121, a }i / of ^ forlh ^ elow H the headm 

to access a configuration of NM agent 104, For example, the "ATTRIBUTE". Item 131 is the corresponding configura- 
administrator may create a new configuration, load this 15 ^ fof « new _ confir which inchdes a Mst of attributcs on 
configuration in object 115 on the distributed network 103, me le f t and corresponding values on the right. This configu- 
and verify whether the configuration has changed in accor- rat i on includes data that can be downloaded to and stored in 
dance with the new configuration. a network device 115 to reconfigure operating parameters of 

More specifically, the existing NM system 102 allows a the network device 115. 
user 120, through an administrator interface 121, to create 20 As discussed above, the CM subsystem 106 may, through 
and edit configuration management (CM) records 107, log the NM process 105, load a configuration to the NM agent 
(store) CM changes 108 and capture (retrieve) existing CM The configuration may be loaded by placing values of 

records 109 from NM agent 104. The existing NM system the configuration attributes into a selected model, the model 
also allows a user 120 to verify CM records 110 and obtain reflecting data entries for the NM agent 104. 
CM status and history reporting 111 . Also, upon receiving an 25 As previously discussed, SPECTRUM is a model-based 
event, the existing CM subsystem 106 may send (download) network management system described in U.S. Pat. No. 
a configuration 112 to object 115. The existing CM sub- 5,261,044, issued Nov. 9, 1993 to R. Dev et aL, and hereby 
system 106 also allows a user 120 to perform configuration ™?!?? rated b * refe / ence ! D lts entiret y- In summary, SPEC- 
scheduling 113 for downloading configurations to object ™ UM * a J 01 ^mtaining ^and processing informa- 
° o o J 30 lion pertaining to the condition of the computer network and 

.' . . , . providing the same to a user, the network including a 

As discussed above, NM station 101 may communicate plurality of network entities such as computer devices and 
configuration changes through NM agent 104. Specifically, software applications being executed on such devices. 
NM station 101 generally communicates with the NM agent Network management system 102 includes a l<virtual 
104 through a NM process 105; the process may use a J5 network » machine> comprising a digital compu ter imple- 
standard network management protocol, such as SNMP. menti aQ objecl . oriented program ming language such as 
Other network management protocols are _ available. The c++> Java> Eiffel> SmalItalk> and Ada . ^ 

virtual network 

NM process 105 includes all of the communication libraries coraprises interrelated intelligent models of network entities 
necessary to communicate with NM agent 104 and the and relations between nelwork entities> mcmding means for 
required libraries .to receive ^events from network devices. In 4Q acquiring nctwork data pertaining to the condition of a 
addition the NM system 102 includes a rule-based event network entit ^ vktual network iQcludes means 

handler 114 to handle events received from network devices for raaintaining objects which includc Detwork data relati 
according to predetermined and/or user defined rules. The t0 rorrW p 01lding network entities and one or more inference 
rule-based event handler 114 provides additional actions for handkrs for roccssi the network data; the inference 
the NM system 102, such as creating events in a log file or A$ haadkrs are responsive t0 ch a occurring m tne same 
contacting an admmistrator with event information. and/or a ^ &nn{ objecU and/of CQanges Qr eyents ifl ^ 

Network 103 may be a data communications network, network or NM system 102. The network data can then be 
such as Ethernet. It should be understood that the NM transferred to a user interface coupled to the virtual network, 
process 105 may communicate over any type of communi- f or supplying the network data to a user. Thus, the models 
cations network including local area networks (LANs), wide 50 are implemented as software objects containing both data 
area networks (WANs), dial-up networks, or the like. (attributes) relating to the corresponding network entity and 

The existing CM subsystem 106 enables a user 120 to one or more inference handlers (functions) for processing 
create configurations with a template. A template is a list of the data. 

attributes for a device of a certain model type. When creating The inference handlers are initiated by predetermined 
a template, the configuration manager provides the user 120 55 virtual network events, such as a change in specified net- 
with a list of attributes for a model type. The user 120 then work data in a network device model, a change in specified 
selects the attributes needed for the template, which, network data in a different model, and predefined events or 
depending on the purpose of the template, might include one changes in models or model relations. Information pertain- 
or many attributes. Templates may be defined and stored in ing to the condition of the network device can be received 
the CM subsystem 106, anywhere on NM station 101, or 60 from the network entity or may be inferred from data 
other location. contained within other models. An alarm condition may be 

The CM subsystem 106 then captures the values of the generated when the network data meets a predetermined 
attributes listed in the template, by retrieving the values from criteria. Events, alarms and statistical information from the 
a model of the managed object 115. Modeling of managed distributed network 103 are stored in a database and are 
objects is described further below. Alternatively, values of 65 selectively displayed for the user 120. In the SPECTRUM 
attributes may be obtained directly from the managed object, system, this database is referred to as the SpectroSERVER 
such as through polling using SNMP. Subsystem 106 gen- database. 
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FIG. 1C shows a configuration management display A-C provide corrective information to the lower-level effec- 

screen 140 as implemented on a SPECTROGRAPH display tors 205 which, through network management process 105, 

of the SPECTRUM system. The display 140 includes a modify configuration data within the corresponding NM 

configuration section 141 which lists available configura- agent 104 and/or the model of object 115 in NM system 102. 

tions by name 144 and information about the selected s The corrective information may be a new configuration 

configuration in other fields pje»nflgn«tio« shown in r6cord) with instructions as to the time of load and the 

this example relate to the model ' CISCOl" 142 (a model for effective ^ riod of me new configuralion . 
a router made by Cisco Systems) previously selected by the _ .. ... , .,„„•„,.,. ™~ „ 
user 143, as indicated on the display 140. The configurations ™ e h *™ ch f s ^ »0 lUustrated hi FIG 2 allows 

listed in section 141 can be loaded to the selected model or 10 "J™ ^ af ^ ma ?i whK * ™ T™^ ' ° f 

to other models of the same model type, and further to ^complexity of the problem and the desired response time. 

schedule automatic loads as described below. The load and ^ lw ? k ° f are ^f^f, FlG - 

u a i *■ • **• * a u 1 ^ 4i_ * +as three alternative double-headed arrows 210, 212 and 214. 

schedule operations are initiated by selecting the icons 146 A .„ t , . . . . v f 

and 147, respectively. The verify operation, designated by ^ ^l^trates reactive behavior (lower) vs. dehb- 

icon 148, enables the user to verify the configuration of the 15 er f tve ^ ha ™ r (^M- Arrow 212 illustrates decreased 

selected model or models, and also to schedule automatic 15 ^terpretation (lower) vs increased interpretation (higher), 

verifications of the network devices. Thus, the existing CM ^ 2 }* * llustra £ s decreased reasoning (lower) vs. 

subsystem 106 allows a user 120 to schedule configuration "creased reasoning (higher). TOese three levels of response 

loads, captures, and verifications during different time peri- arc dcscnbed 111 greater dctai1 below ' 
ods. In addition, subsystem 106 allows the user to maintain 20 Data received from a network management agent withm 

more stable configurations by scheduling automatic loads at a device mav be acted u P on in varying levels of response, 

regular intervals and checking the integrity of the network Generally, intelligent behavior begins with an initial input of 

with periodic automatic captures and verifications of con- data and ends with instructions that are executed by effec- 

figurations. However, the network management system typi- tors - Data received from NM agent 104 is provided as input 

cally requires manual intervention for determining correct 25 to CM svstem 200 and ma y P ass through one or more layers 

configuration management settings for each network device of interpretation. Each layer filters (removes) errored and/or 

and, in a large network, creating such configurations mami- extraneous data out of the data passed to it, and transforms 

ally for each network device is a time-consuming and the data into fewer (less), more informative pieces of data to 

inaccurate operation. formulate a response or pass data to the next layer above. 

As discussed above, configuration data includes attributes 30 Ttia& ' at each laver of interpretation, the analyzer 203 

150 and values 149. In display 140 of FIG. 1C, attributes 150 located at that level mav P r0Vlde a response 207 to executor 

and values 149 associated with a configuration may be 206 based u P° n lhQ interpretation and/or may pass data up 

viewed and edited. Alternatively, as shown in FIG. ID, a list t0 the next abovc - 

of configurations 161 for a model "CISCORTR_l " is When the data becomes manageable, that is, when col- 
shown which includes a number of configurations 163 35 lected data reaches a point where a response can be 
having attributes 164 and values 165. A user may through formulated, the data is compared with predefined knowledge 
display interface 160, insert or delete attributes chosen by abou t what instructions should ensue. This operation is 
the user from a list of insertable attributes 162. Interface 160 usually defined as "responsiveness" and may be imple- 
allows a user to construct configuration records by selecting, mented in a number of ways, including simple look-up 
adding, and deleting attributes. * 40 tables, expert systems, and/or neural networks. The output of 

There will now be described an embodiment of the the executors 206 is a set of instructions. These instructions 

present invention— an intelligent system for automatically ma y be decomposed down through the same levels of 

configuring. As shown in the functional block diagram of interpretation until they are executed by effectors 205. 
FIG. 2, an automatic configuration management (CM) sub- As shown in FIG. 2, there may be separate control loops 

system 200 includes at a lower-most hierarchial level a 45 that respond to a specific class of problems, i.e., the prob- 

nuraber of sensors 204 and effectors 205. Generally, sensors lems are partitioned and assigned to levels according to the 

204 sense data and effectors 205 change data. In this amount of time and the amount of information required to 

embodiment, sensors 204 observe data of network devices solve them. An example of a short-term loop is defined by 

located on the distributed network 103; the observed the flow of data and commands from the NM process 105 to 

(monitored) data is received from network management so sensors 204, continuing up to analyzer 203A and across to 

(NM) process 105. Effectors 205 provide corrective actions executor 206 A, then down effectors 205 to process 105. The 

to NM process 105 in order to modify configuration infer- instructions are communicated to network device(s) through 

mation in object 115 on network 103. network 103. The short -term interpretation/response/ 

The intelligent CM subsystem 200 includes, at a higher execution loop at this lowest level provides for quick 

level, a number of analyzers 203 A-C that interpret data 55 reaction, bypassing upper level control mechanisms. In the 

provided by the sensors 204 below. The data may be network context of network management, such tasks might include 

management data such as performance data related to the intelligent routing and temporary disconnection to a busy 

performance of a device. The hierarchical series of analyzers host. 

203 A-C, as a result of an interpretation of the data provided A medium-term loop solves complex problems and oper- 

by the sensors 204, provide a number of responses 207 A-C 60 ates on an increasingly interpreted input. The medium- term 

to corresponding executors 206 A-C, a response being loop would include analyzer 203B, response 207B and 

provided between an analyzer/executor pair on the same executor 206 B, in addition to process 105, sensors 204 and 

level of the hierarchy. The responses 207 may include new effectors 205; it would not necessarily require (but may 

configuration data to be stored in a device. The executors utilize) lower level analyzer 203 A, response 207A and 

206 A-C are responsible for defining and executing correc- 65 executor 206A. A response 207B to an interpretation pro- 

tive actions as a result of the response information generated vided by analyzer 203 B would be provided to executor 

by the analyzers 203 A-C. The higher level executors 206 206B. An example suitable for a medium-term loop is the 
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interpretation of an event stream which may result in an 
actuation of alarms. The task of the response module may be 
to correlate these alarms, where some alarms are real and 
others are apparent, and the problem is to distinguish 
between real and apparent alarms and suppress apparent s 
alarms. 

A long-term loop solves problems that require more time 
and/or more performance data to determine an answer. The 
long-term loop would include analyzer 203 C, response 
207C and executor 206C, in addition to process 105, sensors 10 
204 and effectors 205; it would not necessarily require (but 
may utilize) one or more of 203 A, 207 A, 706A, 203B, 207B 
and 206B. A response 207C to an interpretation provided by 
analyzer 203 C would be provided to executor 206 C. An 
example of a long-term task would be the problem of 35 
deciding whether to move a host from one subnetwork to 
another A host may be moved in one instance because a 
majority of the host's clients reside on the other subnetwork; 
moving the host to the other (client) subnetwork would thus 
decrease traffic on the link between the two subnetworks. 20 

In summary, reactive behavior (lower level) is concerned 
with those problems whose upper bounds on response time 
is short, and operates on relatively uninterpreted input. In 
contrast, deliberate (higher level) behavior is concerned with 
those problems whose upper bounds on response time is 25 
relatively long, and operates on increasingly interpreted 
input. It should be understood from FIG. 2 that many levels 
of analysis and/or execution may be performed. 

Another example of selecting between short-term and 3Q 
long-term responses is an analysis of router performance. In 
this example, a router in a network exhibits poor perfor- 
mance resulting in observable symptoms such as a high CPU 
utilization, lost packets, and aborted connections. After 
reviewing port and router processing statistics, it is deter- 3S 
mined that excess traffic is being forwarded to the router. A 
short term resolution of this performance problem may 
include reconfiguring the router with a new configuration to 
reduce incoming traffic. One way to reduce traffic is to 
reduce the number of allowed ports on the router to permit 4Q 
only one networks' packets to be forwarded by the router. 
This one network may be deemed to be a critical network by 
the network administrator. In effect, the new configuration 
eliminates all network traffic other than the network traffic 
flowing to and from the critical network. This short-term 45 
resolution frees up the router's resources to handle the 
critical network's packets more effectively, but may impede 
less critical network traffic from arriving at its destination. 

A long-term solution for the router performance problem 
discussed above may include creating a long-term configu- 50 
ration that rearranges subnetworks and devices to balance 
the router load with respect to other networking devices. 
This long-term solution may require additional (higher 
level) analyses involving additional networking devices and 
hosts. 55 

As shown in FIG. 2, the lower- level response loop 105, 

204, 203A, 207 A, 206A, 205, 105 provides a reactive 
behavior with a short-term response time, perhaps with a 
relatively small amount of interpretation of the information 
received from a network device. This lower level loop 60 
typically provides decreased reasoning, (e.g., a lower impact 
response, often with less execution required and with less 
breadth of consideration) than a higher level process. 
Higher-level response loop 105, 204, 203C, 207C, 206C, 

205, 105 provides a more deliberate behavior requiring 65 
increased interpretation of data received from the network 
device. Similarly, this higher level response loop will pro- 
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duce an impact of broader breadth due to the increased scope 
of reasoning. In other words, the result of the higher level 
response loop will generally provide a more dramatic 
change to the configuration of the network device. 

Higher level analyses may be performed manually or by 
a number of conventional analysis programs that are avail- 
able. However, these conventional programs require data to 
be entered manually using complex models. The amount of 
processing time and storage requirements for these programs 
are often exorbitant and prohibitive for a large-scale net- 
work. Further, the network administrator must decide the 
configuration changes to be made. 

To effectively analyze the performance of multiple 
devices in real time, a capacity planner is required. The 
capacity planner is a system that analyzes the performance 
of multiple devices and determines an appropriate perfor- 
mance balance between devices. Such a system is described 
in a U.S. patent application Ser. No. 08/855,222, filed on 
May 13, 1997, entitled APPARATUS AND METHOD FOR 
NETWORK CAPACITY EVALUATION AND 
PLANNING, which is hereby incorporated by reference in 
its entirety. Another system for analyzing network capacity 
is described in U.S. Pat. No. 5,706,436, issued to L. Lewis 
and U. Datta on Jan. 6, 1998, entitled APPARATUS AND 
METHOD FOR EVALUATING NETWORK TRAFFIC 
PERFORMANCE, which is hereby incorporated by refer- 
ence in its entirety. 

FIG. 3 shows one embodiment of a network management 
station 101 including a network management system 301 
which includes a hierarchical set of analyzers according to 
the present invention, one of which is a capacity planner. 
NM System 301 includes a configuration management (CM) 
subsystem 302. Analyzers 304-306 within CM subsystem 
302 provide varying levels of responses 310, 311, 312 to a 
configuration manager 308. The configuration manager may 
include different levels of executors. Configuration manager 
308 outputs CM commands 309 to modify NM agent 104. 
These CM commands 309 may be, for example, Command 
Line Interface (CLI) commands in the SPECTRUM NMS; 
these CLI commands provide access to the device database 
(e.g., the SpectroSERVER database available from 
Cabletron Systems, Inc.), Users may create scripts that 
execute one or more CLI commands. These scripts may be 
invoked from a command line, through a graphical user 
interface, or from a remote system. Scripts and their features 
are well-known in the art of computer programming. 

A rule-based event handler 306 may be used to issue 
commands when certain events occur on the network. One 
such rule-based event handler 306 is the SPECTROWATCH 
event handler available from Cabletron Systems, Inc. Rules 
may be inserted in the rule-based event handler 306 to 
monitor traffic data or other network performance data, and 
execute a CM command 309 when a specific performance 
pattern occurs. For example, consider configuration man- 
agement of a managed object such as a router. If a port on 
a router transmits data above a specified threshold for a 
specified time, the rule-based event handler 306 may con- 
sider this an important event and generate a response 312 
describing the event and forward the response 312 to the 
configuration manager 308, in response to which a CM 
command 309 is executed that places a new, predefined 
configuration into the router. Similarly, when the traffic 
transmitted by the port goes beneath the threshold for a 
given amount of time, the original configuration may be 
loaded into the router. 

It should be understood that any reactive analyzer may be 
used in lieu of or in addition to the rule-based event handler 
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306, such as a case -based reasoning structure, neural net- 
work analyzer, threshold function, model-based reasoning BWT[X) . , „ < 3 ) 

* !u i tl _ ' , J4 . . 6 C0£(X)= -—^ where / = 1.2,,.. /V for* nodes 

structure, or other analyzer that may be used to determine EBwrt/) 

configurations in a reactive manner. 

The capacity planner (CP) 305 as described above may be 5 The nodes N include all of the nodes in the network, 

used as a midlevel analyzer for analyzing performance of a Similarly, a contribution to overall traffic COT(X) is 

network device. The capacity planner 305 observes network determined for link X with respect to all of the traffic in the 

performance statistics over a given period of time (e.g., a network: 

week), and attempts to determine a better network configu- io 

ration based on the concept of network balance. In a C0T(X)= where f- 1, 2, ... N for N nodes (4) 

supervised mode, the capacity planner may offer its results ^ V(/) 
to the administrator through the administrator interface 304, 

whereby the user 120 responds with configuration manage- The contribution to overall bandwidth COB defines a 

ment changes. In an unsupervised mode, the capacity plan- 15 percentage of the bandwidth for a particular link X with 

ner 305 may send instructions directly to the configuration respect to all bandwidth, while the contribution to overall 

manager 308 for modifying the configuration of the NM traffic COT is a measure of the percentage of the actual 

agent 104. traffic transmitted by the link X with respect to all traffic 

during the time T under coasideration. Generally, if these 

In one embodiment, the capacity planner 305 analyzes 20 percentages are similar for different links, then it means that 

capacity by determining a capacity measurement of a net- ^ network is well-balanced with respect to both actual 

work link X. Link X may be, for example, a network link of usage (traffic) and potential usage (bandwidth). Since a 

a networking device 115. This capacity measurement is balanced network is generally desirable, these percentages 

determined by computing the volume of network traffic for ma y be used to determine the overall balance of a network, 

the link over a time period T. This volume information is 25 These two contributions may also be compared with each 

collected in a table or database on the network management other for a particular link X by taking a difference, to define 

station 101. A bandwidth (BW), lower bound (LB) and an evaluation of link balance ELB for the particular link X 

upper bound (UB) are used to indicate "healthy" traffic. BW according to equation (5): 

Ls an inherent property oftbe network Unk while LB and UB eib^-cotpq-cobcx) (5) 

values are subjective properties imposed on a link by the 30 

network administrator. The LB and UB values delimit a When the contribution to overall bandwidth COB is equal 

desired range of network traffic for optimal link perfor- to the contribution to overall traffic COT for a particular link, 

mance. there is an ideal balance, that is the link is providing its "fair 

_ . , „ „ share" of the overall workload of the network. If the 

«™\? P ™l y ^^^"^r 018 foUowmg P™ ters: 35 evaluation of link balance ELB is negative, then the link is 

BWT, V ABU, COB, COT, and ELB. BWT, which indicates ^ te thaQ ^ ^ share> and if * he of ^ 

me capability of the link over period T is computed by balance ELB ^ itivCj (hen the , mk k doin more ±m {{s 

multip ying BW (the theoretical bandwidth) by period T. For fair share A system which forther iUustrates the of 

example, if the BW of a network link is 100 bytes/sec and network balance is described ia a tj. S . patent application, 

the monitoring period of the link is 60 seconds, then the 40 Ser No 0 8/855,222, filed on May 13, 1997, entitled APPA- 

value of the BWT parameter is 6000 bytes. The value of ^ METH0 D FOR NETWORK CAPACITY 

BWT indicates that the link can carry 6000 bytes during a 60 EVALUATION AND PLANNING, by U. Datta and L. 

second period. The equation for BWT for a network link X nQW v $ p at No 6)209) 033 which is incorporated 

may be represented as: herein by reference m hs entirely 

45 Another embodiment of the invention is shown in FIG. 4. 

BWT(X)«BW(X)jcT (l) A network management station 401 may include a network 

management system 405. The network management system 

The ABU parameter indicates the average bandwidth 405 includes similar components to the network manage- 

usage of the link. The actual volume V of the link is ment system 301 (FIG 3)( waer ein like reference numbers 

determined by measuring traffic statistics for the link over a 50 indicate similar devices. The NM system 405 includes a 

period T and stored on NM station 101. From the volume V configuration management subsystem 402, which further 

and the capability BWT, the average bandwidth usage ABU includes a synthesizer 403 positioned between the analyzers 

for link X may be determined according to the following (interface 304, CP 305, event handler 306) and configuration 

equation: manager 308; the synthesizer makes decisions based on 

55 heuristics 404. A network performance monitoring block is 

abu(x)oV(X)/bwt(X) (2) positioned between synthesizer 403 and NM process 105. 

The synthesizer 403 acts as a "broker" (or decision maker) 
Thus, average bandwidth usage ABU is the percentage of for passirjg pro blem information to various services for 
the total link capability that is currently being used over time analysis and solution. Specifically, the synthesizer 403 pro- 
period T. For example, a usage ABU of 5% would indicate 60 vides a centralized control of determining configuration 
that link X may be underutilized because during the time T changes. 

only 5% of its capability is being used; this may represent centralized nature of the synthesizer 403 contrasts 

excess capability and/or a suboptiraal use of resources. ^ ^ e distributed processing (decentralized approach) of 

A contribution to overall bandwidth COB is determined FIG. 3 for solving a configuration management problem. In 

for link X with respect to all of the bandwidth in the network 65 addition, the synthesizer 403 allocates resources based upon 

(i.e., all of the links in a designated network portion), as a traffic flow problem and combines solutions of service 

indicated in equation (3): providers, such as the capacity planner 305 and/or rule- 
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based event handler 306. The synthesizer 403 also resolves 
conflicts in configuration data, based on heuristics 404. For 
example, the synthesizer 403 may resolve a configuration 
conflict between agents such as the capacity planner 305 and 
the rule-based event handler 306. As discussed above, it s 
should be understood that any analyzers may be used in 
association with synthesizer 403. 

Heuristics 404 contains learned data (e.g., concerning 
network performance) that may influence a response to the 
configuration manager 308. Data obtained by heuristics 404 10 
may be loaded before operation of NM station 401 from a 
storage having predefined data, or may "learn" appropriate 
responses from data provided from devices on network 103. 
Learning systems are well known in the art of artificial 
intelligence. 15 

Generally, the synthesizer 403 may determine an opti- 
mum "plan" for resolving an undesirable state in a managed 
object. A plan is a specification for performing an action that 
maps (correlates) what is known at the time of execution of 
the plan to a set of actions, wherein an action is a response. 20 
The plan generally leads to a "goal" which is a subset of the 
set of all states such that a plan is judged successful if it 
results in the system ending up in a state that is part of the 
goal subset. The operation of determining the resulting state, 
given an initial state and an action is termed "progression." 25 
Therefore, based on a set of actions defined as a "plan," the 
synthesizer 403 attempts to achieve a goal state for the 
managed object. These "plans" or sets of actions may be 
implemented as configuration changes in the managed 
object. Also, plans may be "learned" through trial and error, 30 
or other learning process wherein configuration changes 
provide a measurable change in performance of the managed 
object. 

As a result of computing network balance, the capacity 
planner 305 or synthesizer 403 may determine an alternate 35 
configuration of the network. The alternate configuration 
may be implemented through automatically distributing 
configuration changes to various managed objects such as 
network switches. For example, nodes A-E may be physi- 
cally connected in the network by switches 1-4 as shown in 40 
FIG. 5 A. Also, nodes/devices A, B, and C may logically be 
members of a virtual LAN 1 (VLAN 1), and nodes D and E 
may be members of VLAN 2 as shown in FIG. 5. Further, 
data communicated between the nodes may be transmitted 
between nodes and switches through a number of commu- 45 
nication links. The communication links used for a commu- 
nication between two nodes may be defined by configura- 
tions of the switches 1-4. An example list of the links used 
by nodes A-E is listed in FIG. 5C. 

An example of a situation where long-term analysis of 50 
network conditions may not be required is evaluating com- 
munication paths used between nodes. As shown in the table 
of FIG. 5C, communication between nodes B and C traverse 
links 4-8, 2-4, 1-2, and 1-5. As shown by FIG. 5A, the 
number of links traversed may be decreased by using link 55 
1-4 instead of links 2-4 and 1-2. Thus, the switches 1 and 
4 may be instructed by NM systems 301 or 405 to forward 
packets over link 1-4. 

An example of when long-term analysis may be required 
is evaluating the utilization of the network links over a 60 
period of time to determine optimum traffic patterns 
(determine network balance) through switches 1-4 as dis- 
cussed above. This evaluation may be performed by capacity 
planner 305 or synthesizer 403. 

As discussed above, conflicts may occur between con- 65 
figurations determined by different analyzers. If there is a 
conflict between configurations, a conflict resolution strat- 
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egy may be implemented to determine the configuration 
implemented in the device. A system for conflict resolution 
is described in U.S. patent application Ser. No. 08/622,866 
entitled POLICY MANAGEMENT AND CONFLICT 
RESOLUTION IN COMPUTER NETWORKS, filed Mar. 
29, 1996 by S. Thebaut et al. now U.S. Pat. No. 5,889.953, 
which is hereby incorporated by reference. If a conflict 
exists, a configuration determined by deliberative analysis 
may be given precedence over a reactive analysis, or vice 
versa. It should be understood that other conflict resolution 
strategies may be used. 

Another situation that may involve long-term planning 
includes reassigning nodes to VLANs. For example, refer- 
ring now to FIG. 5B, if capacity planner 305 and/or syn- 
thesizer 403 determines that node C performs a majority of 
its communications with nodes D and E and would be better 
suited in VLAN2, capacity planner 305 and/or synthesizer 
403 may issue commands to the network switches 1—4 as 
needed to perform a reassignment of node C to VLAN2. 

A configuration management (CM) process 600 is shown 
in FIG. 6. In one embodiment, this process is performed by 
the CM system 302 shown in FIG. 3. At step 601, the 
configuration management process 600 begins. For this 
example, it is assumed that a management record exists for 
the device before performing process 600. This CM record 
may be created manually from data provided by an admin- 
istrator or automatically through a network discovery pro- 
cess. Creation of configuration records are well-known in 
the art of network management. A default record may be 
used based upon the device type, such as a router, wherein 
values for specific attributes are stored. Once a configuration 
record is created for the device, process 600 may begin 
collecting performance data associated with the device at 
step 605. 

The performance data may be provided to a number of 
processes, which may alter, filter, or add information to the 
performance data. For example, the performance data may 
be provided to a rule -based event handler (step 607), to a 
capacity planner (step 609), or to an administrator interface 
(step 611). These steps may be performed by the rule -based 
event handler 306, the capacity planner 305, and the admin- 
istrator interface 304. The performance data may be specific 
parameters measured from the network, or may be overall 
performance figures of merit, for example those derived by 
combining measured parameters or performing other pro- 
cessing or interpretation of the measured parameters. 
Although several examples herein have been described with 
respect to traffic data, other data may also be measured and 
interpreted, such data being selected based upon the par- 
ticular network characteristics. Other such data includes data 
throughput rate, response time, error rate, error correction 
rate, port availability, port usage, amount of packets 
dropped, and amount of packets delayed. 

As discussed above, the rule-based event handler 306 may 
generate a response 312 based upon the performance data 
provided by the network performance monitoring 307; the 
response 312 is sent to the configuration manager 308. 
Specifically, the rule-based event handler monitors values of 
attributes within the performance data. In response to step 
607, if a monitored value matches a rule in a rule set of the 
rule-based event handler rulebook, the event handler 306 
may generate a response at step 613. This response may 
include defining new configuration data and loading param- 
eters wherein the configuration manger 308 provides a new 
configuration to the device 115 based upon the parameters. 

In step 615, the configuration manager 308 issues con- 
figuration commands 309 to modify the configuration of the 
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device in response to the execution of step 613, step 623, or 
step 629. In one particular embodiment shown in FIG. 6, the 
responses from steps 613 and 623 are synthesized together 
(step 610) to generate a combined response based upon 
event handling and capacity planning, and the combined 5 
response is provided as an input to step 615. In one 
embodiment, modification of the device configuration is 
facilitated through the NM process 105, using a well-known 
network management protocol, to issue communication con- 
figuration commands 309 to NM agent 104. Values of 10 
attributes in NM agent 104 correspond to actual configura- 
tion settings in the device. When changed, the values change 
configuration settings in the device. 

At step 617, following step 615, the process may verify 
that the configuration commands were performed, that is, the 15 
changes to the device configuration were executed. Verifi- 
cation of the configuration may be performed simply by 
comparing the attribute values of the desired configuration 
to the attribute values of the current configuration deter- 
mined through polling NM agent 104. At block 619, one 20 
cycle of the configuration management process 600 ends. It 
is noted that many cycles of process 600 may be performed 
in series or in parallel, wherein CM system 302 performs 
process 600 upon receipt of new performance data from the 
NM process 105 or input from a user 120. 25 

Also, as discussed above, the capacity planner 305 may 
store performance data in a database or file located on the 
NM systems 301, 405. Alternatively, the database may be 
stored in memory or in another location in the network 103. 

At step 607, process 600 provides performance data to the 30 
rule-based event handler 306. The rule-based event handler 
306 compares performance data to individual rules within a 
rules database. In an embodiment in which the performance 
data is traffic data, the rules may be based upon traffic 
statistic variables. If predetermined criteria for a rule is met, 35 
the rule-based event handler 306 generates an appropriate 
response to the configuration manager at step 613, An 
appropriate response may be determined by a network 
expert or network administrator and entered into the rules 
database. 40 

At step 609, process 600 provides performance data to the 
capacity planner 305. The capacity planner stores perfor- 
mance data as historical information in a capacity planner 
database at step 621. Then if enough performance data has 
been collected, the capacity planner will interpret the capac- 45 
ity planner database data and generate an appropriate 
response at step 623. The capacity planner generates a 
response based upon a network reconfiguration which is 
based in turn upon the concept of network balance discussed 
above. It should be understood that different responses may so 
require different amounts of performance data. As in the 
rule-based event handler, an appropriate response may be 
determined by a network expert or network administrator for 
varying levels of network balance. 

Process 600 may provide an optional series of steps by 55 
which a network administrator may provide input to process 
600. At step 611, for example, process 600 may provide 
performance data to the administrator interface 304, and at 
step 627, the performance data is presented to the user. The 
user interprets the performance data and generates a 60 
response at step 629. The user is allowed to enter their own 
configuration management changes based upon performance 
data. Administrator interface 304 may present the data in a 
form that may be easily interpreted by a user. 

While various embodiments of the present invention have 65 
been described above, it should be understood that they have 
been presented by way of example only, and not limitation. 
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Thus, the breadth and scope of the present invention are not 
limited by any of the above-described exemplary 
embodiments, but are defined only in accordance with the 
following claims and their equivalents. 
What is claimed is: 

1. A configuration management system for automatically 
controlling a configuration of an object in a communications 
network, the configuration management system comprising: 

a performance monitor that monitors the network and 
provides as an output performance data of the network; 

an event handler, that receives the performance data and 
evaluates the performance data based upon a set of 
rules and having as an output a rule evaluation of the 
performance data; 

a capacity planner that receives the performance data of 
the network and evaluates the performance data based 
upon network performance and having as an output a 
capacity evaluation of the communications network; 
and 

a configuration manager, receiving the output of the event 
handler, and the output of the capacity planner, and 
providing an output command based on the rule evalu- 
ation and the capacity evaluation. 

2. The configuration management system of claim 1, 
wherein the configuration manager is constructed and 
arranged to verify the success of the command to the object 
by determining whether performance of the communications 
network has improved subsequent to the command being 
provided to the object. 

3. The configuration management system of claim 1, 
wherein the configuration manager includes synthesizer 
having a first input that receives the rule evaluation from the 
output of the event handler, a second input that receives the 
evaluation of the capacity from the output of the capacity 
planner, and an output that provides a single synthesized 
network evaluation to the configuration manager, the con- 
figuration manager providing the command to the object in 
response to the single synthesized network evaluation. 

4. The configuration management system of claim 3, 
wherein the synthesizer is constructed and arrange to resolve 
inconsistencies between the evaluation of the capacity and 
the rule evaluation. 

5. The configuration management system of claim 1, 
wherein the command from the configuration manager 
includes a configuration command that changes a configu- 
ration of the object. 

6. A method for configuring a network device in a 
communications network, the method comprising the steps 
of: 

a) collecting performance data from the communications 
network; 

b) evaluating the performance data according to a set of 
rules to generate a rule evaluation; 

c) determining a capacity evaluation of the network; 

d) determining a new configuration for the network device 
based upon the rule evaluation and the capacity evalu- 
ation; and 

e) reconfiguring the object based on the new configura- 
tion. 

7. The method of claim 6 further comprising a step of 
verifying success of step e). 

8. The method of claim 7, wherein the step of verifying 
includes determining whether the network has improved 
performance subsequent to the object being reconfigured in 
step e). 

9. The method of claim 6, wherein the step of reconfig- 
uring the object includes issuing configuration commands to 
the object. 
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10. The method of claim 6, further comprising the steps 

of: 

determining a new configuration for the object based upon 

the capacity evaluation; and 
reconfiguring the object based on the new configuration. 5 

11. The method of claim 6, wherein step d) includes 
synthesizing the rule evaluation with the capacity evaluation 
to provide a single synthesized network evaluation. 

12. The method of claim 11, wherein the step of synthe- 
sizing includes resolving an inconsistency between the rule 10 
evaluation and the capacity evaluation. 

13. An apparatus for configuring a network device in a 
communications network, the apparatus comprising: 

means for collecting performance data from the commu- 15 
nications network; 

means for evaluating the performance data according to a 
set of rules to generate a rule evaluation; 

means for determining a capacity evaluation of the net- 
work; 20 

means for determining a new configuration for the net- 
work device based upon the rule evaluation and the 
capacity evaluation; and 

means for reconfiguring the object based on the new 
configuration, 25 

14. The apparatus of claim 13, further comprising means 
for verifying success of the new configuration. 

15. The apparatus of claim 14, wherein the means for 
verifying includes means for determining whether the net- 
work has improved performance subsequent to the object 30 
being reconfigured by the means for reconfiguring. 

16. The apparatus of claim 13, wherein the means for 
reconfiguring the device includes means for issuing con- 
figuration commands to the object. 

17. The apparatus of claim 13, further comprising: 35 
means for determining a new configuration for the object 

based upon the capacity evaluation; and 
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means for reconfiguring the object based on the new 
configuration. 

18. The apparatus of claim 13, wherein the means for 
determining a new configuration for the object includes 
means for synthesizing the rule evaluation with the capacity 
evaluation to provide a single synthesized network evalua- 
tion. 

19. The apparatus of claim 18, wherein the means for 
synthesizing includes means for resolving an inconsistency 
between the rule evaluation and the capacity evaluation. 

20. A method of configuring an object in a communica- 
tions network, the method comprising the steps of: 

a) collecting performance data from the object; 

b) analyzing the performance data, wherein the analyzing 
step includes a step of analyzing an event received from 
the object and a step of analyzing a capacity of the 
network; 

c) based on results of step b), determining a configuration 
of the object; and 

d) reconfiguring the object based on the configuration 
determined in step c). 

21. A method of configuring an object in a communica- 
tions network, the method comprising the steps of: 

a) collecting performance data from the object; 

b) analyzing the performance data, wherein the analyzing 
step includes a step of reactively analyzing the perfor- 
mance data and a step of deliberatively analyzing the 
performance data; 

c) based on results of step b), determining a configuration 
of the object; and 

d) reconfiguring the object based on the configuration 
determined in step c). 
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